2019/07/09 - AWS WAF Regional - 3 new4 updated api methods
Changes Update waf-regional client to latest version
See also: AWS API Documentation
Request Syntax
client.tag_resource(
ResourceARN='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
list
[REQUIRED]
(dict) --
Key (string) --
Value (string) --
dict
Response Syntax
{}
Response Structure
(dict) --
See also: AWS API Documentation
Request Syntax
client.untag_resource(
ResourceARN='string',
TagKeys=[
'string',
]
)
string
[REQUIRED]
list
[REQUIRED]
(string) --
dict
Response Syntax
{}
Response Structure
(dict) --
See also: AWS API Documentation
Request Syntax
client.list_tags_for_resource(
NextMarker='string',
Limit=123,
ResourceARN='string'
)
string
integer
string
[REQUIRED]
dict
Response Syntax
{
'NextMarker': 'string',
'TagInfoForResource': {
'ResourceARN': 'string',
'TagList': [
{
'Key': 'string',
'Value': 'string'
},
]
}
}
Response Structure
(dict) --
NextMarker (string) --
TagInfoForResource (dict) --
ResourceARN (string) --
TagList (list) --
(dict) --
Key (string) --
Value (string) --
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Creates a RateBasedRule. The RateBasedRule contains a RateLimit, which specifies the maximum number of requests that AWS WAF allows from a specified IP address in a five-minute period. The RateBasedRule also contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to count or block if these requests exceed the RateLimit.
If you add more than one predicate to a RateBasedRule, a request not only must exceed the RateLimit, but it also must match all the specifications to be counted or blocked. For example, suppose you add the following to a RateBasedRule:
An IPSet that matches the IP address 192.0.2.44/32
A ByteMatchSet that matches BadBot in the User-Agent header
Further, you specify a RateLimit of 15,000.
You then add the RateBasedRule to a WebACL and specify that you want to block requests that meet the conditions in the rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. Further, requests that match these two conditions must be received at a rate of more than 15,000 requests every five minutes. If both conditions are met and the rate is exceeded, AWS WAF blocks the requests. If the rate drops below 15,000 for a five-minute period, AWS WAF no longer blocks the requests.
As a second example, suppose you want to limit requests to a particular page on your site. To do this, you could add the following to a RateBasedRule:
A ByteMatchSet with FieldToMatch of URI
A PositionalConstraint of STARTS_WITH
A TargetString of login
Further, you specify a RateLimit of 15,000.
By adding this RateBasedRule to a WebACL, you could limit requests to your login page without affecting the rest of your site.
To create and configure a RateBasedRule, perform the following steps:
Create and update the predicates that you want to include in the rule. For more information, see CreateByteMatchSet, CreateIPSet, and CreateSqlInjectionMatchSet.
Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRule request.
Submit a CreateRateBasedRule request.
Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
Submit an UpdateRateBasedRule request to specify the predicates that you want to include in the rule.
Create and update a WebACL that contains the RateBasedRule. For more information, see CreateWebACL.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
See also: AWS API Documentation
Request Syntax
client.create_rate_based_rule(
Name='string',
MetricName='string',
RateKey='IP',
RateLimit=123,
ChangeToken='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
A friendly name or description of the RateBasedRule. You can't change the name of a RateBasedRule after you create it.
string
[REQUIRED]
A friendly name or description for the metrics for this RateBasedRule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change the name of the metric after you create the RateBasedRule.
string
[REQUIRED]
The field that AWS WAF uses to determine if requests are likely arriving from a single source and thus subject to rate monitoring. The only valid value for RateKey is IP. IP indicates that requests that arrive from the same IP address are subject to the RateLimit that is specified in the RateBasedRule.
integer
[REQUIRED]
The maximum number of requests, which have an identical value in the field that is specified by RateKey, allowed in a five-minute period. If the number of requests exceeds the RateLimit and the other predicates specified in the rule are also met, AWS WAF triggers the action that is specified for this rule.
string
[REQUIRED]
The ChangeToken that you used to submit the CreateRateBasedRule request. You can also use this value to query the status of the request. For more information, see GetChangeTokenStatus.
list
(dict) --
Key (string) --
Value (string) --
dict
Response Syntax
{
'Rule': {
'RuleId': 'string',
'Name': 'string',
'MetricName': 'string',
'MatchPredicates': [
{
'Negated': True|False,
'Type': 'IPMatch'|'ByteMatch'|'SqlInjectionMatch'|'GeoMatch'|'SizeConstraint'|'XssMatch'|'RegexMatch',
'DataId': 'string'
},
],
'RateKey': 'IP',
'RateLimit': 123
},
'ChangeToken': 'string'
}
Response Structure
(dict) --
Rule (dict) --
The RateBasedRule that is returned in the CreateRateBasedRule response.
RuleId (string) --
A unique identifier for a RateBasedRule. You use RuleId to get more information about a RateBasedRule (see GetRateBasedRule), update a RateBasedRule (see UpdateRateBasedRule), insert a RateBasedRule into a WebACL or delete one from a WebACL (see UpdateWebACL), or delete a RateBasedRule from AWS WAF (see DeleteRateBasedRule).
Name (string) --
A friendly name or description for a RateBasedRule. You can't change the name of a RateBasedRule after you create it.
MetricName (string) --
A friendly name or description for the metrics for a RateBasedRule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change the name of the metric after you create the RateBasedRule.
MatchPredicates (list) --
The Predicates object contains one Predicate element for each ByteMatchSet, IPSet, or SqlInjectionMatchSet object that you want to include in a RateBasedRule.
(dict) --
Specifies the ByteMatchSet, IPSet, SqlInjectionMatchSet, XssMatchSet, RegexMatchSet, GeoMatchSet, and SizeConstraintSet objects that you want to add to a Rule and, for each object, indicates whether you want to negate the settings, for example, requests that do NOT originate from the IP address 192.0.2.44.
Negated (boolean) --
Set Negated to False if you want AWS WAF to allow, block, or count requests based on the settings in the specified ByteMatchSet, IPSet, SqlInjectionMatchSet, XssMatchSet, RegexMatchSet, GeoMatchSet, or SizeConstraintSet. For example, if an IPSet includes the IP address 192.0.2.44, AWS WAF will allow or block requests based on that IP address.
Set Negated to True if you want AWS WAF to allow or block a request based on the negation of the settings in the ByteMatchSet, IPSet, SqlInjectionMatchSet, XssMatchSet, RegexMatchSet, GeoMatchSet, or SizeConstraintSet. For example, if an IPSet includes the IP address 192.0.2.44, AWS WAF will allow, block, or count requests based on all IP addresses except 192.0.2.44.
Type (string) --
The type of predicate in a Rule, such as ByteMatch or IPSet.
DataId (string) --
A unique identifier for a predicate in a Rule, such as ByteMatchSetId or IPSetId. The ID is returned by the corresponding Create or List command.
RateKey (string) --
The field that AWS WAF uses to determine if requests are likely arriving from single source and thus subject to rate monitoring. The only valid value for RateKey is IP. IP indicates that requests arriving from the same IP address are subject to the RateLimit that is specified in the RateBasedRule.
RateLimit (integer) --
The maximum number of requests, which have an identical value in the field specified by the RateKey, allowed in a five-minute period. If the number of requests exceeds the RateLimit and the other predicates specified in the rule are also met, AWS WAF triggers the action that is specified for this rule.
ChangeToken (string) --
The ChangeToken that you used to submit the CreateRateBasedRule request. You can also use this value to query the status of the request. For more information, see GetChangeTokenStatus.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to block. If you add more than one predicate to a Rule, a request must match all of the specifications to be allowed or blocked. For example, suppose that you add the following to a Rule:
An IPSet that matches the IP address 192.0.2.44/32
A ByteMatchSet that matches BadBot in the User-Agent header
You then add the Rule to a WebACL and specify that you want to blocks requests that satisfy the Rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot.
To create and configure a Rule, perform the following steps:
Create and update the predicates that you want to include in the Rule. For more information, see CreateByteMatchSet, CreateIPSet, and CreateSqlInjectionMatchSet.
Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRule request.
Submit a CreateRule request.
Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
Submit an UpdateRule request to specify the predicates that you want to include in the Rule.
Create and update a WebACL that contains the Rule. For more information, see CreateWebACL.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
See also: AWS API Documentation
Request Syntax
client.create_rule(
Name='string',
MetricName='string',
ChangeToken='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
A friendly name or description of the Rule. You can't change the name of a Rule after you create it.
string
[REQUIRED]
A friendly name or description for the metrics for this Rule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change the name of the metric after you create the Rule.
string
[REQUIRED]
The value returned by the most recent call to GetChangeToken.
list
(dict) --
Key (string) --
Value (string) --
dict
Response Syntax
{
'Rule': {
'RuleId': 'string',
'Name': 'string',
'MetricName': 'string',
'Predicates': [
{
'Negated': True|False,
'Type': 'IPMatch'|'ByteMatch'|'SqlInjectionMatch'|'GeoMatch'|'SizeConstraint'|'XssMatch'|'RegexMatch',
'DataId': 'string'
},
]
},
'ChangeToken': 'string'
}
Response Structure
(dict) --
Rule (dict) --
The Rule returned in the CreateRule response.
RuleId (string) --
A unique identifier for a Rule. You use RuleId to get more information about a Rule (see GetRule), update a Rule (see UpdateRule), insert a Rule into a WebACL or delete a one from a WebACL (see UpdateWebACL), or delete a Rule from AWS WAF (see DeleteRule).
RuleId is returned by CreateRule and by ListRules.
Name (string) --
The friendly name or description for the Rule. You can't change the name of a Rule after you create it.
MetricName (string) --
A friendly name or description for the metrics for this Rule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change MetricName after you create the Rule.
Predicates (list) --
The Predicates object contains one Predicate element for each ByteMatchSet, IPSet, or SqlInjectionMatchSet object that you want to include in a Rule.
(dict) --
Specifies the ByteMatchSet, IPSet, SqlInjectionMatchSet, XssMatchSet, RegexMatchSet, GeoMatchSet, and SizeConstraintSet objects that you want to add to a Rule and, for each object, indicates whether you want to negate the settings, for example, requests that do NOT originate from the IP address 192.0.2.44.
Negated (boolean) --
Set Negated to False if you want AWS WAF to allow, block, or count requests based on the settings in the specified ByteMatchSet, IPSet, SqlInjectionMatchSet, XssMatchSet, RegexMatchSet, GeoMatchSet, or SizeConstraintSet. For example, if an IPSet includes the IP address 192.0.2.44, AWS WAF will allow or block requests based on that IP address.
Set Negated to True if you want AWS WAF to allow or block a request based on the negation of the settings in the ByteMatchSet, IPSet, SqlInjectionMatchSet, XssMatchSet, RegexMatchSet, GeoMatchSet, or SizeConstraintSet. For example, if an IPSet includes the IP address 192.0.2.44, AWS WAF will allow, block, or count requests based on all IP addresses except 192.0.2.44.
Type (string) --
The type of predicate in a Rule, such as ByteMatch or IPSet.
DataId (string) --
A unique identifier for a predicate in a Rule, such as ByteMatchSetId or IPSetId. The ID is returned by the corresponding Create or List command.
ChangeToken (string) --
The ChangeToken that you used to submit the CreateRule request. You can also use this value to query the status of the request. For more information, see GetChangeTokenStatus.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a web ACL. You use UpdateRuleGroup to add rules to the rule group.
Rule groups are subject to the following limits:
Three rule groups per account. You can request an increase to this limit by contacting customer support.
One rule group per web ACL.
Ten rules per rule group.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
See also: AWS API Documentation
Request Syntax
client.create_rule_group(
Name='string',
MetricName='string',
ChangeToken='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
A friendly name or description of the RuleGroup. You can't change Name after you create a RuleGroup.
string
[REQUIRED]
A friendly name or description for the metrics for this RuleGroup. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change the name of the metric after you create the RuleGroup.
string
[REQUIRED]
The value returned by the most recent call to GetChangeToken.
list
(dict) --
Key (string) --
Value (string) --
dict
Response Syntax
{
'RuleGroup': {
'RuleGroupId': 'string',
'Name': 'string',
'MetricName': 'string'
},
'ChangeToken': 'string'
}
Response Structure
(dict) --
RuleGroup (dict) --
An empty RuleGroup.
RuleGroupId (string) --
A unique identifier for a RuleGroup. You use RuleGroupId to get more information about a RuleGroup (see GetRuleGroup), update a RuleGroup (see UpdateRuleGroup), insert a RuleGroup into a WebACL or delete a one from a WebACL (see UpdateWebACL), or delete a RuleGroup from AWS WAF (see DeleteRuleGroup).
RuleGroupId is returned by CreateRuleGroup and by ListRuleGroups.
Name (string) --
The friendly name or description for the RuleGroup. You can't change the name of a RuleGroup after you create it.
MetricName (string) --
A friendly name or description for the metrics for this RuleGroup. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change the name of the metric after you create the RuleGroup.
ChangeToken (string) --
The ChangeToken that you used to submit the CreateRuleGroup request. You can also use this value to query the status of the request. For more information, see GetChangeTokenStatus.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count. AWS WAF evaluates Rules in order based on the value of Priority for each Rule.
You also specify a default action, either ALLOW or BLOCK. If a web request doesn't match any of the Rules in a WebACL, AWS WAF responds to the request with the default action.
To create and configure a WebACL, perform the following steps:
Create and update the ByteMatchSet objects and other predicates that you want to include in Rules. For more information, see CreateByteMatchSet, UpdateByteMatchSet, CreateIPSet, UpdateIPSet, CreateSqlInjectionMatchSet, and UpdateSqlInjectionMatchSet.
Create and update the Rules that you want to include in the WebACL. For more information, see CreateRule and UpdateRule.
Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateWebACL request.
Submit a CreateWebACL request.
Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateWebACL request.
Submit an UpdateWebACL request to specify the Rules that you want to include in the WebACL, to specify the default action, and to associate the WebACL with a CloudFront distribution.
For more information about how to use the AWS WAF API, see the AWS WAF Developer Guide.
See also: AWS API Documentation
Request Syntax
client.create_web_acl(
Name='string',
MetricName='string',
DefaultAction={
'Type': 'BLOCK'|'ALLOW'|'COUNT'
},
ChangeToken='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
A friendly name or description of the WebACL. You can't change Name after you create the WebACL.
string
[REQUIRED]
A friendly name or description for the metrics for this WebACL.The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change MetricName after you create the WebACL.
dict
[REQUIRED]
The action that you want AWS WAF to take when a request doesn't match the criteria specified in any of the Rule objects that are associated with the WebACL.
Type (string) -- [REQUIRED]
Specifies how you want AWS WAF to respond to requests that match the settings in a Rule. Valid settings include the following:
ALLOW: AWS WAF allows requests
BLOCK: AWS WAF blocks requests
COUNT: AWS WAF increments a counter of the requests that match all of the conditions in the rule. AWS WAF then continues to inspect the web request based on the remaining rules in the web ACL. You can't specify COUNT for the default action for a WebACL.
string
[REQUIRED]
The value returned by the most recent call to GetChangeToken.
list
(dict) --
Key (string) --
Value (string) --
dict
Response Syntax
{
'WebACL': {
'WebACLId': 'string',
'Name': 'string',
'MetricName': 'string',
'DefaultAction': {
'Type': 'BLOCK'|'ALLOW'|'COUNT'
},
'Rules': [
{
'Priority': 123,
'RuleId': 'string',
'Action': {
'Type': 'BLOCK'|'ALLOW'|'COUNT'
},
'OverrideAction': {
'Type': 'NONE'|'COUNT'
},
'Type': 'REGULAR'|'RATE_BASED'|'GROUP',
'ExcludedRules': [
{
'RuleId': 'string'
},
]
},
],
'WebACLArn': 'string'
},
'ChangeToken': 'string'
}
Response Structure
(dict) --
WebACL (dict) --
The WebACL returned in the CreateWebACL response.
WebACLId (string) --
A unique identifier for a WebACL. You use WebACLId to get information about a WebACL (see GetWebACL), update a WebACL (see UpdateWebACL), and delete a WebACL from AWS WAF (see DeleteWebACL).
WebACLId is returned by CreateWebACL and by ListWebACLs.
Name (string) --
A friendly name or description of the WebACL. You can't change the name of a WebACL after you create it.
MetricName (string) --
A friendly name or description for the metrics for this WebACL. The name can contain only alphanumeric characters (A-Z, a-z, 0-9), with maximum length 128 and minimum length one. It can't contain whitespace or metric names reserved for AWS WAF, including "All" and "Default_Action." You can't change MetricName after you create the WebACL.
DefaultAction (dict) --
The action to perform if none of the Rules contained in the WebACL match. The action is specified by the WafAction object.
Type (string) --
Specifies how you want AWS WAF to respond to requests that match the settings in a Rule. Valid settings include the following:
ALLOW: AWS WAF allows requests
BLOCK: AWS WAF blocks requests
COUNT: AWS WAF increments a counter of the requests that match all of the conditions in the rule. AWS WAF then continues to inspect the web request based on the remaining rules in the web ACL. You can't specify COUNT for the default action for a WebACL.
Rules (list) --
An array that contains the action for each Rule in a WebACL, the priority of the Rule, and the ID of the Rule.
(dict) --
The ActivatedRule object in an UpdateWebACL request specifies a Rule that you want to insert or delete, the priority of the Rule in the WebACL, and the action that you want AWS WAF to take when a web request matches the Rule ( ALLOW, BLOCK, or COUNT).
To specify whether to insert or delete a Rule, use the Action parameter in the WebACLUpdate data type.
Priority (integer) --
Specifies the order in which the Rules in a WebACL are evaluated. Rules with a lower value for Priority are evaluated before Rules with a higher value. The value must be a unique integer. If you add multiple Rules to a WebACL, the values don't need to be consecutive.
RuleId (string) --
The RuleId for a Rule. You use RuleId to get more information about a Rule (see GetRule), update a Rule (see UpdateRule), insert a Rule into a WebACL or delete a one from a WebACL (see UpdateWebACL), or delete a Rule from AWS WAF (see DeleteRule).
RuleId is returned by CreateRule and by ListRules.
Action (dict) --
Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the Rule. Valid values for Action include the following:
ALLOW: CloudFront responds with the requested object.
BLOCK: CloudFront responds with an HTTP 403 (Forbidden) status code.
COUNT: AWS WAF increments a counter of requests that match the conditions in the rule and then continues to inspect the web request based on the remaining rules in the web ACL.
ActivatedRule|OverrideAction applies only when updating or adding a RuleGroup to a WebACL. In this case, you do not use ActivatedRule|Action. For all other update requests, ActivatedRule|Action is used instead of ActivatedRule|OverrideAction.
Type (string) --
Specifies how you want AWS WAF to respond to requests that match the settings in a Rule. Valid settings include the following:
ALLOW: AWS WAF allows requests
BLOCK: AWS WAF blocks requests
COUNT: AWS WAF increments a counter of the requests that match all of the conditions in the rule. AWS WAF then continues to inspect the web request based on the remaining rules in the web ACL. You can't specify COUNT for the default action for a WebACL.
OverrideAction (dict) --
Use the OverrideAction to test your RuleGroup.
Any rule in a RuleGroup can potentially block a request. If you set the OverrideAction to None, the RuleGroup will block a request if any individual rule in the RuleGroup matches the request and is configured to block that request. However if you first want to test the RuleGroup, set the OverrideAction to Count. The RuleGroup will then override any block action specified by individual rules contained within the group. Instead of blocking matching requests, those requests will be counted. You can view a record of counted requests using GetSampledRequests.
ActivatedRule|OverrideAction applies only when updating or adding a RuleGroup to a WebACL. In this case you do not use ActivatedRule|Action. For all other update requests, ActivatedRule|Action is used instead of ActivatedRule|OverrideAction.
Type (string) --
COUNT overrides the action specified by the individual rule within a RuleGroup . If set to NONE, the rule's action will take place.
Type (string) --
The rule type, either REGULAR, as defined by Rule, RATE_BASED, as defined by RateBasedRule, or GROUP, as defined by RuleGroup. The default is REGULAR. Although this field is optional, be aware that if you try to add a RATE_BASED rule to a web ACL without setting the type, the UpdateWebACL request will fail because the request tries to add a REGULAR rule with the specified ID, which does not exist.
ExcludedRules (list) --
An array of rules to exclude from a rule group. This is applicable only when the ActivatedRule refers to a RuleGroup.
Sometimes it is necessary to troubleshoot rule groups that are blocking traffic unexpectedly (false positives). One troubleshooting technique is to identify the specific rule within the rule group that is blocking the legitimate traffic and then disable (exclude) that particular rule. You can exclude rules from both your own rule groups and AWS Marketplace rule groups that have been associated with a web ACL.
Specifying ExcludedRules does not remove those rules from the rule group. Rather, it changes the action for the rules to COUNT. Therefore, requests that match an ExcludedRule are counted but not blocked. The RuleGroup owner will receive COUNT metrics for each ExcludedRule.
If you want to exclude rules from a rule group that is already associated with a web ACL, perform the following steps:
Use the AWS WAF logs to identify the IDs of the rules that you want to exclude. For more information about the logs, see Logging Web ACL Traffic Information.
Submit an UpdateWebACL request that has two actions:
The first action deletes the existing rule group from the web ACL. That is, in the UpdateWebACL request, the first Updates:Action should be DELETE and Updates:ActivatedRule:RuleId should be the rule group that contains the rules that you want to exclude.
The second action inserts the same rule group back in, but specifying the rules to exclude. That is, the second Updates:Action should be INSERT, Updates:ActivatedRule:RuleId should be the rule group that you just removed, and ExcludedRules should contain the rules that you want to exclude.
(dict) --
The rule to exclude from a rule group. This is applicable only when the ActivatedRule refers to a RuleGroup. The rule must belong to the RuleGroup that is specified by the ActivatedRule.
RuleId (string) --
The unique identifier for the rule to exclude from the rule group.
WebACLArn (string) --
Tha Amazon Resource Name (ARN) of the web ACL.
ChangeToken (string) --
The ChangeToken that you used to submit the CreateWebACL request. You can also use this value to query the status of the request. For more information, see GetChangeTokenStatus.